BENTON – Former Lewis and Clark Community College student Dennis Lancaster of Edwardsville seeks to lead a class action on a claim that a data breach allowed criminals to steal information about his identity and health.
His counsel Christopher Byron of Edwardsville claims at U.S. district court that the breach occurred in November 2021, and the school didn’t notify victims until April 2022.
He claims criminals accessed addresses, birth dates, facial photographs, security codes, health information, and numbers for social security, driver’s license, accounts, and passports.
Byron defined the class as all individuals residing in Illinois whose information was compromised.
Notices went to about 38,000 individuals, according to the school.
Byron filed Lancaster’s suit in the Madison County circuit court in April, where his late father Nicholas Byron presided over class actions.
He claimed criminals easily bypassed the school’s systems.
He also claimed the school violated industry standards by storing sensitive information in several locations, protecting data in some systems while leaving it unguarded in others.
He added that the notice didn’t explain who breached the systems or how it occurred.
Byron claimed victims face a lifetime risk of identity theft.
“Plaintiff fears for his personal financial security and uncertainty over what information was revealed in the data breach,” he wrote.
“He is experiencing feelings of anxiety, sleep disruption, stress and fear because of the data breach,” he added.
“Further, plaintiff is unsure what has happened to his personal health information and personal identifying information as Lewis and Clark has been unwilling to disclose the true nature of the data breach, despite plaintiff’s request,” he continued.
Byron claimed stolen health information can be worth up to $1,000.
He claimed it trades for years and criminals post it on the dark web, available for a fee.
He quoted former federal trade commission Pamela Harbour stating, “Data is currency.”
Lewis and Clark removed the suit to district court on June 2, asserting authority three ways under the national Class Action Fairness Act of 2005.
First, Lewis and Clark counsel Amy Lenz of Chicago claimed the Act requires federal jurisdiction when any class member is a citizen of another state.
She claimed Lewis and Clark sent notices to 48 states and military bases in Europe.
She wrote that citizenship is determined by domicile, which refers to the place where one resides and intends to remain.
She claimed state of residency is not equivalent to domicile.
“As Plaintiff does not limit his class to current Illinois residents or citizens, it is likely that at least some prior Illinois residents who were impacted in the Data Incident were residents or even citizens of other states at the time of removal,” she wrote.
She claimed citizenship of an individual is determined at the time of removal.
She also claimed the class has more than 100 members and the Act requires federal jurisdiction above that amount.
She added that the amount in controversy exceeds $5 million and the Act requires federal jurisdiction above that amount.
The court clerk randomly assigned Magistrate Judge Reona Daly, who will preside if the parties consent to magistrate jurisdiction.
If the parties reject magistrate jurisdiction, the clerk will assign a district judge.